ID OPENSSH_71.NASL Type nessus Reporter Tenable Modified 2018-08-08T00:00:00
Description
According to its banner, the version of OpenSSH running on the remote host is 7.x prior to 7.1. It is, therefore, affected by a security bypass vulnerability due to a logic error that is triggered under certain compile-time configurations when PermitRootLogin is set to 'prohibit-password' or 'without-password'. An unauthenticated, remote attacker can exploit this to permit password authentication to root while preventing other forms of authentication.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(85690);
script_version("1.5");
script_cvs_date("Date: 2018/08/08 12:52:14");
script_name(english:"OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass");
script_summary(english:"Checks the OpenSSH banner version.");
script_set_attribute(attribute:"synopsis", value:
"The SSH server running on the remote host is affected by a security
bypass vulnerability.");
script_set_attribute(attribute:"description", value:
"According to its banner, the version of OpenSSH running on the remote
host is 7.x prior to 7.1. It is, therefore, affected by a security
bypass vulnerability due to a logic error that is triggered under
certain compile-time configurations when PermitRootLogin is set to
'prohibit-password' or 'without-password'. An unauthenticated, remote
attacker can exploit this to permit password authentication to root
while preventing other forms of authentication.");
script_set_attribute(attribute:"see_also", value:"http://www.openssh.com/txt/release-7.1");
script_set_attribute(attribute:"solution", value:"Upgrade to OpenSSH 7.1 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/21");
script_set_attribute(attribute:"patch_publication_date", value:"2015/08/21");
script_set_attribute(attribute:"plugin_publication_date", value:"2015/08/28");
script_set_attribute(attribute:"potential_vulnerability", value:"true");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:openbsd:openssh");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Misc.");
script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
script_dependencies("ssh_detect.nasl");
script_require_keys("Settings/ParanoidReport");
script_require_ports("Services/ssh");
exit(0);
}
include("audit.inc");
include("backport.inc");
include("global_settings.inc");
include("misc_func.inc");
# Ensure the port is open.
port = get_service(svc:"ssh", exit_on_fail:TRUE);
# Get banner for service.
banner = get_kb_item_or_exit("SSH/banner/"+port);
bp_banner = tolower(get_backport_banner(banner:banner));
if ("openssh" >!< bp_banner) audit(AUDIT_NOT_LISTEN, "OpenSSH", port);
if (report_paranoia < 2) audit(AUDIT_PARANOID);
if (backported) audit(code:0, AUDIT_BACKPORT_SERVICE, port, "OpenSSH");
# Check the version in the backported banner.
match = eregmatch(string:bp_banner, pattern:"openssh[-_]([0-9][-._0-9a-z]+)");
if (isnull(match)) audit(AUDIT_SERVICE_VER_FAIL, "OpenSSH", port);
version = match[1];
# Affected : 7.x < 7.1
if (version =~ "^7\.0($|[^0-9])")
{
if (report_verbosity > 0)
{
report =
'\n Version source : ' + banner +
'\n Installed version : ' + version +
'\n Fixed version : 7.1\n';
security_note(port:port, extra:report);
}
else security_note(port);
exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, "OpenSSH", port, version);
{"id": "OPENSSH_71.NASL", "bulletinFamily": "scanner", "title": "OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass", "description": "According to its banner, the version of OpenSSH running on the remote host is 7.x prior to 7.1. It is, therefore, affected by a security bypass vulnerability due to a logic error that is triggered under certain compile-time configurations when PermitRootLogin is set to 'prohibit-password' or 'without-password'. An unauthenticated, remote attacker can exploit this to permit password authentication to root while preventing other forms of authentication.", "published": "2015-08-28T00:00:00", "modified": "2018-08-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=85690", "reporter": "Tenable", "references": ["http://www.openssh.com/txt/release-7.1"], "cvelist": [], "type": "nessus", "lastseen": "2019-02-21T01:24:59", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "According to its banner, the version of OpenSSH running on the remote host is 7.x prior to 7.1. It is, therefore, affected by a security bypass vulnerability due to a logic error that is triggered under certain compile-time configurations when PermitRootLogin is set to 'prohibit-password' or 'without-password'. An unauthenticated, remote attacker can exploit this to permit password authentication to root while preventing other forms of authentication.", "edition": 1, "enchantments": {}, "hash": "92fe80e46dc12c25533e4554b18c56099b269551dc219b8dec57855f20c23629", "hashmap": [{"hash": "7ae1367a32e9cb19336468878c9203fb", "key": "published"}, {"hash": "f988dc6e0b4d047c838adcca890ea132", "key": "naslFamily"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "cf5ab192321e0c9602e97a714f8a5102", "key": "modified"}, {"hash": "4fa4da60a2c0d33ba179df6ab9842020", "key": "title"}, {"hash": "1108e55af3df0b194f3f5378f7ca9d46", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3781ad0c6cc65a1e9af5a4ffb36035e1", "key": "references"}, {"hash": "f27efb19d589f98d2e152a14d3af8c95", "key": "href"}, {"hash": "e37381254d584db631984a8ea66372b5", "key": "pluginID"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "5e4ee62b2633767cd9aaf2f53d8e6c0c", "key": "sourceData"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85690", "id": "OPENSSH_71.NASL", "lastseen": "2016-09-26T17:24:30", "modified": "2015-10-22T00:00:00", "naslFamily": "Misc.", "objectVersion": "1.2", "pluginID": "85690", "published": "2015-08-28T00:00:00", "references": ["http://www.openssh.com/txt/release-7.1"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85690);\n script_version(\"$Revision: 1.3 $\");\n script_cvs_date(\"$Date: 2015/10/22 18:55:31 $\");\n\n script_osvdb_id(126641);\n\n script_name(english:\"OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass\");\n script_summary(english:\"Checks the OpenSSH banner version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The SSH server running on the remote host is affected by a security\nbypass vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of OpenSSH running on the remote\nhost is 7.x prior to 7.1. It is, therefore, affected by a security\nbypass vulnerability due to a logic error that is triggered under\ncertain compile-time configurations when PermitRootLogin is set to\n'prohibit-password' or 'without-password'. An unauthenticated, remote\nattacker can exploit this to permit password authentication to root\nwhile preventing other forms of authentication.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.openssh.com/txt/release-7.1\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to OpenSSH 7.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/28\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openbsd:openssh\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_detect.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/ssh\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"backport.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Ensure the port is open.\nport = get_service(svc:\"ssh\", exit_on_fail:TRUE);\n\n# Get banner for service.\nbanner = get_kb_item_or_exit(\"SSH/banner/\"+port);\n\nbp_banner = tolower(get_backport_banner(banner:banner));\nif (\"openssh\" >!< bp_banner) audit(AUDIT_NOT_LISTEN, \"OpenSSH\", port);\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\nif (backported) audit(code:0, AUDIT_BACKPORT_SERVICE, port, \"OpenSSH\");\n\n# Check the version in the backported banner.\nmatch = eregmatch(string:bp_banner, pattern:\"openssh[-_]([0-9][-._0-9a-z]+)\");\nif (isnull(match)) audit(AUDIT_SERVICE_VER_FAIL, \"OpenSSH\", port);\nversion = match[1];\n\n# Affected : 7.x < 7.1\nif (version =~ \"^7\\.0($|[^0-9])\")\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.1\\n';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, \"OpenSSH\", port, version);\n", "title": "OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass", "type": "nessus", "viewCount": 2}, "differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:24:30"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:openbsd:openssh"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "According to its banner, the version of OpenSSH running on the remote\nhost is 7.x prior to 7.1. It is, therefore, affected by a security\nbypass vulnerability due to a logic error that is triggered under\ncertain compile-time configurations when PermitRootLogin is set to\n'prohibit-password' or 'without-password'. An unauthenticated, remote\nattacker can exploit this to permit password authentication to root\nwhile preventing other forms of authentication.", "edition": 4, "enchantments": {"dependencies": {"modified": "2019-01-16T20:22:20", "references": []}, "score": {"value": 7.5, "vector": "NONE"}}, "hash": "ab93c048981866536b9841076b0b68ad428298f3b13ec72f07cd1f38a0340cac", "hashmap": [{"hash": "7ae1367a32e9cb19336468878c9203fb", "key": "published"}, {"hash": "f988dc6e0b4d047c838adcca890ea132", "key": "naslFamily"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "c0b35c0f76d5f4b9ec94d58c6415e03b", "key": "cpe"}, {"hash": "4fa4da60a2c0d33ba179df6ab9842020", "key": "title"}, {"hash": "63329048f010c87d85370bb01ea70b93", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3781ad0c6cc65a1e9af5a4ffb36035e1", "key": "references"}, {"hash": "e051b85a440e02b8a928743fa338eff2", "key": "sourceData"}, {"hash": "f27efb19d589f98d2e152a14d3af8c95", "key": "href"}, {"hash": "42ab8bb9420a333513cba1c71a3454c8", "key": "description"}, {"hash": "e37381254d584db631984a8ea66372b5", "key": "pluginID"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85690", "id": "OPENSSH_71.NASL", "lastseen": "2019-01-16T20:22:20", "modified": "2018-08-08T00:00:00", "naslFamily": "Misc.", "objectVersion": "1.3", "pluginID": "85690", "published": "2015-08-28T00:00:00", "references": ["http://www.openssh.com/txt/release-7.1"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85690);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/08/08 12:52:14\");\n\n\n script_name(english:\"OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass\");\n script_summary(english:\"Checks the OpenSSH banner version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The SSH server running on the remote host is affected by a security\nbypass vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of OpenSSH running on the remote\nhost is 7.x prior to 7.1. It is, therefore, affected by a security\nbypass vulnerability due to a logic error that is triggered under\ncertain compile-time configurations when PermitRootLogin is set to\n'prohibit-password' or 'without-password'. An unauthenticated, remote\nattacker can exploit this to permit password authentication to root\nwhile preventing other forms of authentication.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.openssh.com/txt/release-7.1\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to OpenSSH 7.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/28\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openbsd:openssh\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_detect.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/ssh\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"backport.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Ensure the port is open.\nport = get_service(svc:\"ssh\", exit_on_fail:TRUE);\n\n# Get banner for service.\nbanner = get_kb_item_or_exit(\"SSH/banner/\"+port);\n\nbp_banner = tolower(get_backport_banner(banner:banner));\nif (\"openssh\" >!< bp_banner) audit(AUDIT_NOT_LISTEN, \"OpenSSH\", port);\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\nif (backported) audit(code:0, AUDIT_BACKPORT_SERVICE, port, \"OpenSSH\");\n\n# Check the version in the backported banner.\nmatch = eregmatch(string:bp_banner, pattern:\"openssh[-_]([0-9][-._0-9a-z]+)\");\nif (isnull(match)) audit(AUDIT_SERVICE_VER_FAIL, \"OpenSSH\", port);\nversion = match[1];\n\n# Affected : 7.x < 7.1\nif (version =~ \"^7\\.0($|[^0-9])\")\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.1\\n';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, \"OpenSSH\", port, version);\n", "title": "OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass", "type": "nessus", "viewCount": 19}, "differentElements": ["description"], "edition": 4, "lastseen": "2019-01-16T20:22:20"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:openbsd:openssh"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "According to its banner, the version of OpenSSH running on the remote host is 7.x prior to 7.1. It is, therefore, affected by a security bypass vulnerability due to a logic error that is triggered under certain compile-time configurations when PermitRootLogin is set to 'prohibit-password' or 'without-password'. An unauthenticated, remote attacker can exploit this to permit password authentication to root while preventing other forms of authentication.", "edition": 3, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "4a5993fd067710fe4755b1ca75bc6d5abd65daaa8c13d3d80db11972d9e6c822", "hashmap": [{"hash": "7ae1367a32e9cb19336468878c9203fb", "key": "published"}, {"hash": "f988dc6e0b4d047c838adcca890ea132", "key": "naslFamily"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "c0b35c0f76d5f4b9ec94d58c6415e03b", "key": "cpe"}, {"hash": "4fa4da60a2c0d33ba179df6ab9842020", "key": "title"}, {"hash": "1108e55af3df0b194f3f5378f7ca9d46", "key": "description"}, {"hash": "63329048f010c87d85370bb01ea70b93", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3781ad0c6cc65a1e9af5a4ffb36035e1", "key": "references"}, {"hash": "e051b85a440e02b8a928743fa338eff2", "key": "sourceData"}, {"hash": "f27efb19d589f98d2e152a14d3af8c95", "key": "href"}, {"hash": "e37381254d584db631984a8ea66372b5", "key": "pluginID"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85690", "id": "OPENSSH_71.NASL", "lastseen": "2018-08-10T17:08:45", "modified": "2018-08-08T00:00:00", "naslFamily": "Misc.", "objectVersion": "1.3", "pluginID": "85690", "published": "2015-08-28T00:00:00", "references": ["http://www.openssh.com/txt/release-7.1"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85690);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/08/08 12:52:14\");\n\n\n script_name(english:\"OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass\");\n script_summary(english:\"Checks the OpenSSH banner version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The SSH server running on the remote host is affected by a security\nbypass vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of OpenSSH running on the remote\nhost is 7.x prior to 7.1. It is, therefore, affected by a security\nbypass vulnerability due to a logic error that is triggered under\ncertain compile-time configurations when PermitRootLogin is set to\n'prohibit-password' or 'without-password'. An unauthenticated, remote\nattacker can exploit this to permit password authentication to root\nwhile preventing other forms of authentication.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.openssh.com/txt/release-7.1\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to OpenSSH 7.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/28\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openbsd:openssh\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_detect.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/ssh\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"backport.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Ensure the port is open.\nport = get_service(svc:\"ssh\", exit_on_fail:TRUE);\n\n# Get banner for service.\nbanner = get_kb_item_or_exit(\"SSH/banner/\"+port);\n\nbp_banner = tolower(get_backport_banner(banner:banner));\nif (\"openssh\" >!< bp_banner) audit(AUDIT_NOT_LISTEN, \"OpenSSH\", port);\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\nif (backported) audit(code:0, AUDIT_BACKPORT_SERVICE, port, \"OpenSSH\");\n\n# Check the version in the backported banner.\nmatch = eregmatch(string:bp_banner, pattern:\"openssh[-_]([0-9][-._0-9a-z]+)\");\nif (isnull(match)) audit(AUDIT_SERVICE_VER_FAIL, \"OpenSSH\", port);\nversion = match[1];\n\n# Affected : 7.x < 7.1\nif (version =~ \"^7\\.0($|[^0-9])\")\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.1\\n';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, \"OpenSSH\", port, version);\n", "title": "OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass", "type": "nessus", "viewCount": 18}, "differentElements": ["description"], "edition": 3, "lastseen": "2018-08-10T17:08:45"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:openbsd:openssh"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "According to its banner, the version of OpenSSH running on the remote host is 7.x prior to 7.1. It is, therefore, affected by a security bypass vulnerability due to a logic error that is triggered under certain compile-time configurations when PermitRootLogin is set to 'prohibit-password' or 'without-password'. An unauthenticated, remote attacker can exploit this to permit password authentication to root while preventing other forms of authentication.", "edition": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "1ae360a76fa4a70bb2c4f83cae3fa6cfb7f47b9312ec1cdc26e7cad563958a58", "hashmap": [{"hash": "7ae1367a32e9cb19336468878c9203fb", "key": "published"}, {"hash": "f988dc6e0b4d047c838adcca890ea132", "key": "naslFamily"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "c0b35c0f76d5f4b9ec94d58c6415e03b", "key": "cpe"}, {"hash": "cf5ab192321e0c9602e97a714f8a5102", "key": "modified"}, {"hash": "4fa4da60a2c0d33ba179df6ab9842020", "key": "title"}, {"hash": "1108e55af3df0b194f3f5378f7ca9d46", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3781ad0c6cc65a1e9af5a4ffb36035e1", "key": "references"}, {"hash": "f27efb19d589f98d2e152a14d3af8c95", "key": "href"}, {"hash": "e37381254d584db631984a8ea66372b5", "key": "pluginID"}, {"hash": "5e4ee62b2633767cd9aaf2f53d8e6c0c", "key": "sourceData"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=85690", "id": "OPENSSH_71.NASL", "lastseen": "2017-10-29T13:37:47", "modified": "2015-10-22T00:00:00", "naslFamily": "Misc.", "objectVersion": "1.3", "pluginID": "85690", "published": "2015-08-28T00:00:00", "references": ["http://www.openssh.com/txt/release-7.1"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85690);\n script_version(\"$Revision: 1.3 $\");\n script_cvs_date(\"$Date: 2015/10/22 18:55:31 $\");\n\n script_osvdb_id(126641);\n\n script_name(english:\"OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass\");\n script_summary(english:\"Checks the OpenSSH banner version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The SSH server running on the remote host is affected by a security\nbypass vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of OpenSSH running on the remote\nhost is 7.x prior to 7.1. It is, therefore, affected by a security\nbypass vulnerability due to a logic error that is triggered under\ncertain compile-time configurations when PermitRootLogin is set to\n'prohibit-password' or 'without-password'. An unauthenticated, remote\nattacker can exploit this to permit password authentication to root\nwhile preventing other forms of authentication.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.openssh.com/txt/release-7.1\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to OpenSSH 7.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/28\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openbsd:openssh\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_detect.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/ssh\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"backport.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Ensure the port is open.\nport = get_service(svc:\"ssh\", exit_on_fail:TRUE);\n\n# Get banner for service.\nbanner = get_kb_item_or_exit(\"SSH/banner/\"+port);\n\nbp_banner = tolower(get_backport_banner(banner:banner));\nif (\"openssh\" >!< bp_banner) audit(AUDIT_NOT_LISTEN, \"OpenSSH\", port);\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\nif (backported) audit(code:0, AUDIT_BACKPORT_SERVICE, port, \"OpenSSH\");\n\n# Check the version in the backported banner.\nmatch = eregmatch(string:bp_banner, pattern:\"openssh[-_]([0-9][-._0-9a-z]+)\");\nif (isnull(match)) audit(AUDIT_SERVICE_VER_FAIL, \"OpenSSH\", port);\nversion = match[1];\n\n# Affected : 7.x < 7.1\nif (version =~ \"^7\\.0($|[^0-9])\")\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.1\\n';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, \"OpenSSH\", port, version);\n", "title": "OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass", "type": "nessus", "viewCount": 11}, "differentElements": ["modified", "sourceData"], "edition": 2, "lastseen": "2017-10-29T13:37:47"}], "edition": 5, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "c0b35c0f76d5f4b9ec94d58c6415e03b"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "1108e55af3df0b194f3f5378f7ca9d46"}, {"key": "href", "hash": "f27efb19d589f98d2e152a14d3af8c95"}, {"key": "modified", "hash": "63329048f010c87d85370bb01ea70b93"}, {"key": "naslFamily", "hash": "f988dc6e0b4d047c838adcca890ea132"}, {"key": "pluginID", "hash": "e37381254d584db631984a8ea66372b5"}, {"key": "published", "hash": "7ae1367a32e9cb19336468878c9203fb"}, {"key": "references", "hash": "3781ad0c6cc65a1e9af5a4ffb36035e1"}, {"key": "reporter", "hash": "9cf00d658b687f030ebe173a0528c567"}, {"key": "sourceData", "hash": "e051b85a440e02b8a928743fa338eff2"}, {"key": "title", "hash": "4fa4da60a2c0d33ba179df6ab9842020"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "4a5993fd067710fe4755b1ca75bc6d5abd65daaa8c13d3d80db11972d9e6c822", "viewCount": 19, "enchantments": {"dependencies": {"references": [], "modified": "2019-02-21T01:24:59"}, "score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85690);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/08/08 12:52:14\");\n\n\n script_name(english:\"OpenSSH 7.x < 7.1 PermitRootLogin Security Bypass\");\n script_summary(english:\"Checks the OpenSSH banner version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The SSH server running on the remote host is affected by a security\nbypass vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of OpenSSH running on the remote\nhost is 7.x prior to 7.1. It is, therefore, affected by a security\nbypass vulnerability due to a logic error that is triggered under\ncertain compile-time configurations when PermitRootLogin is set to\n'prohibit-password' or 'without-password'. An unauthenticated, remote\nattacker can exploit this to permit password authentication to root\nwhile preventing other forms of authentication.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.openssh.com/txt/release-7.1\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to OpenSSH 7.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/28\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openbsd:openssh\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_detect.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/ssh\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"backport.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\n# Ensure the port is open.\nport = get_service(svc:\"ssh\", exit_on_fail:TRUE);\n\n# Get banner for service.\nbanner = get_kb_item_or_exit(\"SSH/banner/\"+port);\n\nbp_banner = tolower(get_backport_banner(banner:banner));\nif (\"openssh\" >!< bp_banner) audit(AUDIT_NOT_LISTEN, \"OpenSSH\", port);\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\nif (backported) audit(code:0, AUDIT_BACKPORT_SERVICE, port, \"OpenSSH\");\n\n# Check the version in the backported banner.\nmatch = eregmatch(string:bp_banner, pattern:\"openssh[-_]([0-9][-._0-9a-z]+)\");\nif (isnull(match)) audit(AUDIT_SERVICE_VER_FAIL, \"OpenSSH\", port);\nversion = match[1];\n\n# Affected : 7.x < 7.1\nif (version =~ \"^7\\.0($|[^0-9])\")\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 7.1\\n';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, \"OpenSSH\", port, version);\n", "naslFamily": "Misc.", "pluginID": "85690", "cpe": ["cpe:/a:openbsd:openssh"], "scheme": null}